marty/rm-circle-team-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PolHunter embed on /training, CSP allows polhunter.com

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-19 14:12:25 -05:00
parent 9ad864c0ba
commit c6e6acbdc5
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/training.html
+2 -1
View File
@@ -106,4 +106,5 @@
</div></section> </div></section>
</main> </main>
<footer class="wrap disclaimer">This is an independent RM Circle Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a><a href="/tools">Promo Tools</a><a href="/privacy">Privacy</a><a href="/refunds">Refunds</a></div></footer> <footer class="wrap disclaimer">This is an independent RM Circle Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a><a href="/tools">Promo Tools</a><a href="/privacy">Privacy</a><a href="/refunds">Refunds</a></div></footer>
<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/vtt-lang.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html> <script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/vtt-lang.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script><script src="https://polhunter.com/embed.js" data-selector=".video-card" data-slots="10" async></script>
</body></html>
server.js
+1 -1
View File
@@ -578,7 +578,7 @@ async function handleTranslate(req,res){
// frame-src includes 'self' so our own pages (the Page Builder preview framing // frame-src includes 'self' so our own pages (the Page Builder preview framing
// a member's /p/<id> page) are not blocked by our own policy. // a member's /p/<id> page) are not blocked by our own policy.
const CSP_BASE="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; const CSP_BASE="default-src 'self'; script-src 'self' https://polhunter.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self' https://polhunter.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; // polhunter.com: the PolHunter embed on /training (2026-09-19)
function securityHeaders(extra={}) { function securityHeaders(extra={}) {
// Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS. // Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS.
return { return {